Microsoft.SecurityInsights-Metadaten

Bicep-Ressourcendefinition

Der Metadatenressourcentyp kann mit Vorgängen bereitgestellt werden, die auf Folgendes abzielen:

Eine Liste der geänderten Eigenschaften in jeder API-Version finden Sie unter Änderungsprotokoll.

Ressourcenformat

Um eine Microsoft.SecurityInsights/Metadata-Ressource zu erstellen, fügen Sie der Vorlage den folgenden Bicep hinzu.

resource symbolicname 'Microsoft.SecurityInsights/metadata@2025-09-01' = {
  scope: resourceSymbolicName or scope
  etag: 'string'
  name: 'string'
  properties: {
    author: {
      email: 'string'
      link: 'string'
      name: 'string'
    }
    categories: {
      domains: [
        'string'
      ]
      verticals: [
        'string'
      ]
    }
    contentId: 'string'
    contentSchemaVersion: 'string'
    customVersion: 'string'
    dependencies: {
      contentId: 'string'
      criteria: [
        ...
      ]
      kind: 'string'
      name: 'string'
      operator: 'string'
      version: 'string'
    }
    firstPublishDate: 'string'
    icon: 'string'
    kind: 'string'
    lastPublishDate: 'string'
    parentId: 'string'
    previewImages: [
      'string'
    ]
    previewImagesDark: [
      'string'
    ]
    providers: [
      'string'
    ]
    source: {
      kind: 'string'
      name: 'string'
      sourceId: 'string'
    }
    support: {
      email: 'string'
      link: 'string'
      name: 'string'
      tier: 'string'
    }
    threatAnalysisTactics: [
      'string'
    ]
    threatAnalysisTechniques: [
      'string'
    ]
    version: 'string'
  }
}

Eigenschaftswerte

Microsoft.SecurityInsights/Metadata

MetadatenAutor

Metadaten-Kategorien

Metadatenabhängigkeiten

MetadatenEigenschaften

MetadatenQuelle

MetadatenUnterstützung

ARM-Vorlagenressourcendefinition

Der Metadatenressourcentyp kann mit Vorgängen bereitgestellt werden, die auf Folgendes abzielen:

Eine Liste der geänderten Eigenschaften in jeder API-Version finden Sie unter Änderungsprotokoll.

Ressourcenformat

Um eine Microsoft.SecurityInsights/Metadata-Ressource zu erstellen, fügen Sie Der Vorlage den folgenden JSON-Code hinzu.

{
  "type": "Microsoft.SecurityInsights/metadata",
  "apiVersion": "2025-09-01",
  "name": "string",
  "etag": "string",
  "properties": {
    "author": {
      "email": "string",
      "link": "string",
      "name": "string"
    },
    "categories": {
      "domains": [ "string" ],
      "verticals": [ "string" ]
    },
    "contentId": "string",
    "contentSchemaVersion": "string",
    "customVersion": "string",
    "dependencies": {
      "contentId": "string",
      "criteria": [
        ...
      ],
      "kind": "string",
      "name": "string",
      "operator": "string",
      "version": "string"
    },
    "firstPublishDate": "string",
    "icon": "string",
    "kind": "string",
    "lastPublishDate": "string",
    "parentId": "string",
    "previewImages": [ "string" ],
    "previewImagesDark": [ "string" ],
    "providers": [ "string" ],
    "source": {
      "kind": "string",
      "name": "string",
      "sourceId": "string"
    },
    "support": {
      "email": "string",
      "link": "string",
      "name": "string",
      "tier": "string"
    },
    "threatAnalysisTactics": [ "string" ],
    "threatAnalysisTechniques": [ "string" ],
    "version": "string"
  }
}

Eigenschaftswerte

Microsoft.SecurityInsights/Metadata

MetadatenAutor

Metadaten-Kategorien

Metadatenabhängigkeiten

MetadatenEigenschaften

MetadatenQuelle

MetadatenUnterstützung

Verwendungsbeispiele

Terraform -Ressourcendefinition (AzAPI-Anbieter)

Der Metadatenressourcentyp kann mit Vorgängen bereitgestellt werden, die auf Folgendes abzielen:

Eine Liste der geänderten Eigenschaften in jeder API-Version finden Sie unter Änderungsprotokoll.

Ressourcenformat

Um eine Microsoft.SecurityInsights/Metadata-Ressource zu erstellen, fügen Sie Ihrer Vorlage die folgende Terraform hinzu.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.SecurityInsights/metadata@2025-09-01"
  name = "string"
  parent_id = "string"
  body = {
    etag = "string"
    properties = {
      author = {
        email = "string"
        link = "string"
        name = "string"
      }
      categories = {
        domains = [
          "string"
        ]
        verticals = [
          "string"
        ]
      }
      contentId = "string"
      contentSchemaVersion = "string"
      customVersion = "string"
      dependencies = {
        contentId = "string"
        criteria = [
          ...
        ]
        kind = "string"
        name = "string"
        operator = "string"
        version = "string"
      }
      firstPublishDate = "string"
      icon = "string"
      kind = "string"
      lastPublishDate = "string"
      parentId = "string"
      previewImages = [
        "string"
      ]
      previewImagesDark = [
        "string"
      ]
      providers = [
        "string"
      ]
      source = {
        kind = "string"
        name = "string"
        sourceId = "string"
      }
      support = {
        email = "string"
        link = "string"
        name = "string"
        tier = "string"
      }
      threatAnalysisTactics = [
        "string"
      ]
      threatAnalysisTechniques = [
        "string"
      ]
      version = "string"
    }
  }
}

Eigenschaftswerte

Microsoft.SecurityInsights/Metadata

MetadatenAutor

Metadaten-Kategorien

Metadatenabhängigkeiten

MetadatenEigenschaften

MetadatenQuelle

MetadatenUnterstützung

Verwendungsbeispiele

Terraform-Beispiele

Ein einfaches Beispiel für die Bereitstellung von Sentinel-Metadaten.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "workspace" {
  type      = "Microsoft.OperationalInsights/workspaces@2022-10-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      features = {
        disableLocalAuth                            = false
        enableLogAccessUsingOnlyResourcePermissions = true
      }
      publicNetworkAccessForIngestion = "Enabled"
      publicNetworkAccessForQuery     = "Enabled"
      retentionInDays                 = 30
      sku = {
        name = "PerGB2018"
      }
      workspaceCapping = {
        dailyQuotaGb = -1
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "onboardingState" {
  type      = "Microsoft.SecurityInsights/onboardingStates@2023-06-01-preview"
  parent_id = azapi_resource.workspace.id
  name      = "default"
  body = {
    properties = {
      customerManagedKey = false
    }
  }
}

resource "azapi_resource" "alertRule" {
  type      = "Microsoft.SecurityInsights/alertRules@2022-10-01-preview"
  parent_id = azapi_resource.workspace.id
  name      = var.resource_name
  body = {
    kind = "NRT"
    properties = {
      description         = ""
      displayName         = "Some Rule"
      enabled             = true
      query               = "AzureActivity |\n  where OperationName == \"Create or Update Virtual Machine\" or OperationName ==\"Create Deployment\" |\n  where ActivityStatus == \"Succeeded\" |\n  make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller\n"
      severity            = "High"
      suppressionDuration = "PT5H"
      suppressionEnabled  = false
      tactics = [
      ]
      techniques = [
      ]
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
  depends_on                = [azapi_resource.onboardingState]
}

resource "azapi_resource" "metadata" {
  type      = "Microsoft.SecurityInsights/metadata@2022-10-01-preview"
  parent_id = azapi_resource.workspace.id
  name      = var.resource_name
  body = {
    properties = {
      contentId            = var.resource_name
      contentSchemaVersion = "2.0"
      kind                 = "AnalyticsRule"
      parentId             = azapi_resource.alertRule.id
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}